Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PM- 2059 Update Two factor webauthn dialog #9009

Open
wants to merge 7 commits into
base: main
Choose a base branch
from

Conversation

KiruthigaManivannan
Copy link
Collaborator

Type of change

- [ ] Bug fix
- [ ] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [x] Other

Objective

Update Two factor webauthn dialog component to use the component library

Code changes

  • two-factor-webauthn.component.html: Converted modal to dialog compoenents
  • two-factor-webauthn.component.ts: Added dialog open method. Data passed to dialog is typed.
  • two-factor-setup.component.ts: Added Web authn dialog logic and passing the result of two factor verify dialog in the switch statement of mange method call.

Screenshots

Two-step.login._Webauth_.Bitwarden.Web.vault.-.Google.Chrome.2024-05-02.13-42-28.mp4

@KiruthigaManivannan KiruthigaManivannan requested a review from a team as a code owner May 2, 2024 08:13
@github-actions github-actions bot added the needs-qa Marks a PR as requiring QA approval label May 2, 2024
@KiruthigaManivannan
Copy link
Collaborator Author

@rr-bw When I click the read key button , it is not opening the windows authentication using PIN like in QA vault. That may be due to that im running using local host. Because I get the following err ..
image

This error is due to the rp value in publicKeyCredentials passed to navigator. So I think this will work in qa vault

Copy link

codecov bot commented May 2, 2024

Codecov Report

Attention: Patch coverage is 13.63636% with 19 lines in your changes are missing coverage. Please review.

Project coverage is 28.15%. Comparing base (75975dd) to head (d5a6d60).

Files Patch % Lines
...app/auth/settings/two-factor-webauthn.component.ts 15.00% 16 Missing and 1 partial ⚠️
...rc/app/auth/settings/two-factor-setup.component.ts 0.00% 2 Missing ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##             main    #9009   +/-   ##
=======================================
  Coverage   28.14%   28.15%           
=======================================
  Files        2372     2372           
  Lines       70074    70085   +11     
  Branches    13149    13150    +1     
=======================================
+ Hits        19722    19732   +10     
  Misses      48788    48788           
- Partials     1564     1565    +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Contributor

github-actions bot commented May 2, 2024

Logo
Checkmarx One – Scan Summary & Details0e1e7e98-26a6-43d1-b52d-8120f61dbbfe

Fixed Issues

Severity Issue Source File / Package
HIGH Client_DOM_Code_Injection /apps/web/src/connectors/common.ts: 2
HIGH Client_DOM_Code_Injection /apps/browser/src/autofill/services/collect-autofill-content.service.ts: 1054
HIGH Client_DOM_Stored_XSS /apps/web/src/connectors/sso.ts: 33
HIGH Client_DOM_XSS /apps/browser/src/auth/scripts/duo.js: 285
HIGH Client_DOM_XSS /apps/browser/src/auth/scripts/duo.js: 285
HIGH Client_DOM_XSS /apps/desktop/src/auth/scripts/duo.js: 285
HIGH Client_DOM_XSS /apps/desktop/src/auth/scripts/duo.js: 285
HIGH Client_DOM_XSS /apps/web/src/connectors/common.ts: 2
HIGH Client_DOM_XSS /apps/web/src/connectors/common.ts: 2
HIGH Client_DOM_XSS /apps/web/src/connectors/common.ts: 2
HIGH Client_DOM_XSS /apps/web/src/connectors/common.ts: 2
HIGH Client_DOM_XSS /apps/web/src/connectors/sso.ts: 21
HIGH Client_DOM_XSS /apps/web/src/connectors/sso.ts: 19
HIGH Client_DOM_XSS /apps/web/src/connectors/sso.ts: 15
MEDIUM Absolute_Path_Traversal /apps/cli/src/commands/serve.command.ts: 347
MEDIUM Absolute_Path_Traversal /apps/cli/src/commands/serve.command.ts: 315
MEDIUM Absolute_Path_Traversal /apps/cli/src/commands/serve.command.ts: 347
MEDIUM Absolute_Path_Traversal /apps/cli/src/commands/serve.command.ts: 315
MEDIUM Angular_Improper_Type_Pipe_Usage /apps/browser/src/vault/popup/components/fido2/fido2-use-browser-link.component.html: 1
MEDIUM Client_Privacy_Violation /apps/browser/src/background/runtime.background.ts: 314
MEDIUM Client_Privacy_Violation /apps/web/src/app/tools/reports/pages/breach-report.component.html: 14
MEDIUM Client_Privacy_Violation /apps/browser/src/auth/popup/account-switching/account.component.ts: 12
MEDIUM Client_Privacy_Violation /apps/browser/src/auth/popup/account-switching/account.component.ts: 12
MEDIUM Client_Privacy_Violation /apps/browser/src/auth/popup/account-switching/account.component.ts: 12
MEDIUM Client_Privacy_Violation /libs/components/src/color-password/color-password.component.ts: 25
MEDIUM Client_Privacy_Violation /libs/components/src/color-password/color-password.component.ts: 26
MEDIUM Client_Privacy_Violation /apps/desktop/src/auth/lock.component.html: 32
MEDIUM Client_Privacy_Violation /apps/web/src/app/auth/lock.component.html: 18
MEDIUM Client_Privacy_Violation /bitwarden_license/bit-web/src/app/auth/sso/sso.component.ts: 161
MEDIUM Client_Privacy_Violation /bitwarden_license/bit-web/src/app/auth/sso/sso.component.ts: 161
MEDIUM Client_Privacy_Violation /apps/web/src/connectors/webauthn-fallback.ts: 116
MEDIUM Client_Privacy_Violation /apps/desktop/src/auth/lock.component.html: 32
MEDIUM Client_Privacy_Violation /apps/web/src/app/auth/recover-two-factor.component.html: 37
MEDIUM Client_Privacy_Violation /apps/web/src/app/auth/lock.component.html: 18
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 534
MEDIUM Client_Privacy_Violation /libs/components/src/color-password/color-password.component.ts: 14
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 60
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 56
MEDIUM Client_Privacy_Violation /apps/browser/src/tools/popup/generator/password-generator-history.component.html: 26
MEDIUM Client_Privacy_Violation /apps/browser/src/vault/popup/components/vault/password-history.component.html: 18
MEDIUM Client_Privacy_Violation /apps/desktop/src/app/tools/password-generator-history.component.html: 15
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/password-history.component.html: 12
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 50
MEDIUM Client_Privacy_Violation /libs/components/src/color-password/color-password.component.ts: 14
MEDIUM Client_Privacy_Violation /apps/browser/src/tools/popup/generator/password-generator-history.component.html: 26
MEDIUM Client_Privacy_Violation /apps/browser/src/vault/popup/components/vault/password-history.component.html: 18
MEDIUM Client_Privacy_Violation /apps/desktop/src/app/tools/password-generator-history.component.html: 15
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/password-history.component.html: 12
MEDIUM Missing_HSTS_Header /apps/cli/src/auth/commands/login.command.ts: 707
MEDIUM SSRF /libs/importer/src/importers/lastpass/access/services/rest-client.ts: 69
MEDIUM SSRF /libs/importer/src/importers/lastpass/access/services/rest-client.ts: 69
LOW Angular_Usage_of_Unsafe_DOM_Sanitizer /apps/desktop/src/app/components/avatar.component.ts: 75
LOW Angular_Usage_of_Unsafe_DOM_Sanitizer /libs/components/src/avatar/avatar.component.ts: 80
LOW Angular_Usage_of_Unsafe_DOM_Sanitizer /libs/components/src/icon/icon.component.ts: 18
LOW Angular_Usage_of_Unsafe_DOM_Sanitizer /libs/components/src/icon/icon.component.ts: 18
LOW Client_DOM_Open_Redirect /apps/browser/src/platform/popup/layout/popup-header.component.ts: 29
LOW Client_DOM_Open_Redirect /apps/desktop/src/auth/accessibility-cookie.component.html: 18
LOW Client_DOM_Open_Redirect /apps/web/src/connectors/common.ts: 2
LOW Client_DOM_Open_Redirect /apps/web/src/connectors/common.ts: 2
LOW Client_DOM_Open_Redirect /apps/web/src/connectors/common.ts: 2
LOW Client_DOM_Open_Redirect /apps/web/src/connectors/sso.ts: 21
LOW Client_DOM_Open_Redirect /apps/web/src/connectors/common.ts: 2
LOW Client_DOM_Open_Redirect /apps/web/src/connectors/sso.ts: 19
LOW Client_DOM_Open_Redirect /apps/web/src/connectors/common.ts: 2
LOW Client_DOM_Open_Redirect /apps/web/src/connectors/sso.ts: 15
LOW Client_DOM_Open_Redirect /apps/browser/src/tools/popup/generator/password-generator-history.component.ts: 18
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/popup/account-switching/current-account.component.ts: 35
LOW Client_DOM_Open_Redirect /apps/desktop/src/auth/login/login-via-auth-request.component.ts: 60
LOW Client_DOM_Open_Redirect /apps/desktop/src/auth/login/login-via-auth-request.component.ts: 60
LOW Client_DOM_Open_Redirect /apps/desktop/src/auth/login/login-via-auth-request.component.ts: 60
LOW Client_DOM_Open_Redirect /apps/desktop/src/auth/login/login-via-auth-request.component.ts: 60
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/popup/account-switching/account.component.ts: 24
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/popup/login-via-auth-request.component.ts: 52
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/popup/login-via-auth-request.component.ts: 52
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/popup/login-via-auth-request.component.ts: 52
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/popup/login-via-auth-request.component.ts: 52
LOW Client_DOM_Open_Redirect /apps/browser/src/vault/popup/components/vault/password-history.component.ts: 21
LOW Client_DOM_Open_Redirect /apps/browser/src/billing/popup/settings/premium.component.ts: 27
LOW Client_DOM_Open_Redirect /apps/browser/src/vault/popup/components/vault/attachments.component.ts: 32
LOW Client_DOM_Open_Redirect /libs/common/src/auth/iframe-component.ts: 49
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /apps/desktop/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /apps/desktop/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /libs/common/src/auth/webauthn-iframe.ts: 25
LOW Client_DOM_Open_Redirect /apps/desktop/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /apps/desktop/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /apps/desktop/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /apps/desktop/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /libs/common/src/auth/webauthn-iframe.ts: 25
LOW Client_DOM_Open_Redirect /apps/desktop/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /apps/desktop/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/scripts/duo.js: 277
LOW Client_DOM_Open_Redirect /apps/browser/src/auth/scripts/duo.js: 277
LOW Client_Hardcoded_Domain /apps/web/src/app/billing/shared/payment.component.ts: 56
LOW Client_Hardcoded_Domain /apps/web/src/app/billing/shared/payment.component.ts: 56
LOW Client_Hardcoded_Domain /apps/web/src/connectors/captcha.ts: 57
LOW Client_JQuery_Deprecated_Symbols /apps/cli/src/auth/commands/login.command.ts: 575
LOW Client_JQuery_Deprecated_Symbols /libs/angular/src/auth/components/update-temp-password.component.ts: 132
LOW Client_JQuery_Deprecated_Symbols /libs/angular/src/auth/components/change-password.component.ts: 91
LOW Client_JQuery_Deprecated_Symbols /apps/cli/src/program.ts: 615
LOW Client_Use_Of_Iframe_Without_Sandbox /apps/browser/src/autofill/content/notification-bar.ts: 868
LOW Client_Use_Of_Iframe_Without_Sandbox /apps/browser/src/autofill/overlay/iframe-content/autofill-overlay-iframe.service.ts: 90
LOW Client_Use_Of_Iframe_Without_Sandbox /apps/web/src/connectors/duo.ts: 8
LOW Client_Use_Of_Iframe_Without_Sandbox /apps/web/src/connectors/duo.ts: 8
LOW Client_Weak_Cryptographic_Hash /libs/common/src/platform/services/web-crypto-function.service.ts: 142
LOW Client_Weak_Cryptographic_Hash /apps/desktop/src/proxy/ipc.ts: 24
LOW Missing_CSP_Header /apps/cli/src/auth/commands/login.command.ts: 707
LOW Unprotected_Cookie /apps/web/src/app/auth/two-factor.component.ts: 143
LOW Unprotected_Cookie /apps/web/src/connectors/duo-redirect.ts: 57
LOW Unprotected_Cookie /apps/web/src/connectors/duo-redirect.ts: 112
LOW Unprotected_Cookie /apps/web/src/connectors/sso.ts: 33
LOW Unprotected_Cookie /apps/web/src/app/auth/sso.component.ts: 137
LOW Unsafe_Use_Of_Target_blank /apps/web/src/app/auth/settings/two-factor-recovery.component.ts: 25
LOW Use_of_Broken_or_Risky_Cryptographic_Algorithm /apps/cli/src/vault/create.command.ts: 68

Copy link
Contributor

@rr-bw rr-bw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When I click "Save" I get the following error, are you able to track this down? Everything works fine on main. Let me know if you need help debugging.

Screenshot 2024-05-17 at 11 42 33 AM

@KiruthigaManivannan
Copy link
Collaborator Author

When I click "Save" I get the following error, are you able to track this down? Everything works fine on main. Let me know if you need help debugging.

Screenshot 2024-05-17 at 11 42 33 AM

@rr-bw Actually the issue is when we give name in the name input field , it should read key. Since we already have issue in reading key in local host , webAuthnResponse is null. And actual workflow is if webAuthnResponse is null Save button should be disabled. It should not be enabled and user is unable to click. But here even if the webAuthnResponse is null save is getting enabled. Yes please help me in debugging.

@KiruthigaManivannan
Copy link
Collaborator Author

When I click "Save" I get the following error, are you able to track this down? Everything works fine on main. Let me know if you need help debugging.
Screenshot 2024-05-17 at 11 42 33 AM

@rr-bw Actually the issue is when we give name in the name input field , it should read key. Since we already have issue in reading key in local host , webAuthnResponse is null. And actual workflow is if webAuthnResponse is null Save button should be disabled. It should not be enabled and user is unable to click. But here even if the webAuthnResponse is null save is getting enabled. Yes please help me in debugging.

@rr-bw Please advise on the above

Copy link
Contributor

@rr-bw rr-bw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It won't let me comment on the specific line, but line 39 of the html file needs updated to tw-text-muted.

webAuthnComp.auth(result);
webAuthnComp.onUpdated.pipe(takeUntil(this.destroy$)).subscribe((enabled: boolean) => {
this.updateStatus(enabled, TwoFactorProviderType.WebAuthn);
webAuthnComp.componentInstance.onChangeStatus.subscribe((enabled: any) => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be enabled: boolean?

webAuthnComp.onUpdated.pipe(takeUntil(this.destroy$)).subscribe((enabled: boolean) => {
this.updateStatus(enabled, TwoFactorProviderType.WebAuthn);
webAuthnComp.componentInstance.onChangeStatus.subscribe((enabled: any) => {
this.updateStatus(enabled, TwoFactorProviderType.Authenticator);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TwoFactorProviderType.WebAuthn, not Authenticator.

@@ -31,6 +33,7 @@ interface Key {
templateUrl: "two-factor-webauthn.component.html",
})
export class TwoFactorWebAuthnComponent extends TwoFactorBaseComponent {
@Output() onChangeStatus = new EventEmitter<boolean>();
type = TwoFactorProviderType.WebAuthn;
name: string;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do will still need name? Where do we access this property?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rr-bw Yes this is used in setup component , to immediately send enabled status to set up component , the enabled tick mark should appear before we close the dialog . so we are using this event emitter.

constructor(
@Inject(DIALOG_DATA) protected data: AuthResponse<TwoFactorWebAuthnResponse>,
private dialogRef: DialogRef,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is private dialogRef: DialogRef injection needed? I don't see where we are reading it.

<li>{{ "twoFactorWebAuthnSupportWeb" | i18n }}</li>
</ul>
</app-callout>
<img class="tw-float-right tw-ml-5 mfaType7" alt="FIDO2 WebAuthn logo'" />
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you remove the trailing single quote ' in the string?

Comment on lines 26 to 31
<p *ngIf="!k.configured || !k.name" bitTypography="body1" class="tw-font-bold">
{{ "webAuthnkeyX" | i18n: i + 1 }}
</p>
<p *ngIf="k.configured && k.name" bitTypography="body1" class="tw-font-bold">
{{ k.name }}
</p>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Go with <span>s here instead of paragraphs. Our paragraphs add some extra margin on the bottom which spreads them out. The original spacing looks like this:

Screenshot 2024-05-23 at 1 32 02 AM

<li>{{ "twoFactorU2fTouchButton" | i18n }}</li>
<li>{{ "twoFactorU2fSaveForm" | i18n }}</li>
</ol>
<div class="tw-flex tw-flex-row">
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think tw-flex-row is unnecessary because it is the default.

</div>
<button
bitButton
bitFornButton
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo: bitFormButton

{{ "save" | i18n }}
</button>
<button
#disableBtn
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we are using this #disableBtn templateRef anymore.

@rr-bw
Copy link
Contributor

rr-bw commented May 23, 2024

When I click "Save" I get the following error, are you able to track this down? Everything works fine on main. Let me know if you need help debugging.
Screenshot 2024-05-17 at 11 42 33 AM

@rr-bw Actually the issue is when we give name in the name input field , it should read key. Since we already have issue in reading key in local host , webAuthnResponse is null. And actual workflow is if webAuthnResponse is null Save button should be disabled. It should not be enabled and user is unable to click. But here even if the webAuthnResponse is null save is getting enabled. Yes please help me in debugging.

@jlf0dev or @JaredSnider-Bitwarden Would either of you have capacity to help in debugging this? I can't seem to track down the issue. The "save" button is somehow getting enabled when you simply start typing in the name field. It's supposed to remain disabled as long as webAuthnResponse is null. It's almost like form status changes are overriding our [disabled]="!webAuthnResponse" on the "save" button. One odd thing I noticed is that if I remove bitFormButton from the "save" button, it will in fact remain disabled until you Read Key. (But we still then have the problem where clicking "save" gives an error).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs-qa Marks a PR as requiring QA approval
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants